IBM Security Access Manager for Enterprise Single Sign-On Version Epic Integration Guide IBM SC

Transcription

1 IBM Security Access Manager for Enterprise Single Sign-On Version Epic Integration Guide IBM SC

2

3 IBM Security Access Manager for Enterprise Single Sign-On Version Epic Integration Guide IBM SC

4 Note Before using this information and the product it supports, read the information in Notices on page 13. Edition notice Note: This edition applies to version of IBM Security Access Manager for Enterprise Single Sign-On, (product number 5724 V67) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2002, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this publication v Access to publications and terminology..... v Accessibility viii Technical training viii Support information viii Statement of Good Security Practices ix Chapter 1. Overview of the product integration with Epic Chapter 2. Supported workflows and Epic configurations Chapter 3. Epic support deployment.. 5 Chapter 4. Customization Changing the authentication service in an AccessProfile Changing the signature in the AccessProfile Chapter 5. Audit logs for Epic Chapter 6. Troubleshooting checklist for Epic B C D E F G H I J K L M N O P R S T U V W Index Notices Glossary A Copyright IBM Corp. 2002, 2013 iii

6 iv IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

7 About this publication IBM Security Access Manager for Enterprise Single Sign-On Epic Integration Guide provides information about the IBM Security Access Manager for Enterprise Single Sign-On and Epic integration, including supported workflows, configurations, and deployment. Access to publications and terminology This section provides: v A list of publications in the IBM Security Access Manager for Enterprise Single Sign-On library. v Links to Online publications on page viii. v A link to the IBM Terminology website on page viii. IBM Security Access Manager for Enterprise Single Sign-On library The following documents are available in the IBM Security Access Manager for Enterprise Single Sign-On library: v IBM Security Access Manager for Enterprise Single Sign-On Quick Start Guide, CF3T3ML IBM Security Access Manager for Enterprise Single Sign-On Quick Start Guide provides a quick start on the main installation and configuration tasks to deploy and use IBM Security Access Manager for Enterprise Single Sign-On. v IBM Security Access Manager for Enterprise Single Sign-On Planning and Deployment Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Planning and Deployment Guide contains information about planning your deployment and preparing your environment. It provides an overview of the product features and components, the required installation and configuration, and the different deployment scenarios. It also describes how to achieve high availability and disaster recovery. Read this guide before you do any installation or configuration tasks. v IBM Security Access Manager for Enterprise Single Sign-On Installation Guide, GI IBM Security Access Manager for Enterprise Single Sign-On Installation Guide provides detailed procedures on installation, upgrade, or uninstallation of IBM Security Access Manager for Enterprise Single Sign-On. This guide helps you to install the different product components and their required middleware. It also includes the initial configurations that are required to complete the product deployment. It covers procedures for using WebSphere Application Server Base editions, and Network Deployment. v IBM Security Access Manager for Enterprise Single Sign-On Configuration Guide, GC IBM Security Access Manager for Enterprise Single Sign-On Configuration Guide provides information about configuring the IMS Server settings, the AccessAgent user interface, and its behavior. v IBM Security Access Manager for Enterprise Single Sign-On Administrator Guide, SC Copyright IBM Corp. 2002, 2013 v

8 This guide is intended for the Administrators. It covers the different Administrator tasks. IBM Security Access Manager for Enterprise Single Sign-On Administrator Guide provides procedures for creating and assigning policy templates, editing policy values, generating logs and reports, and backing up the IMS Server and its database. Use this guide together with the IBM Security Access Manager for Enterprise Single Sign-On Policies Definition Guide. v IBM Security Access Manager for Enterprise Single Sign-On Policies Definition Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Policies Definition Guide provides detailed descriptions of the different user, machine, and system policies that Administrators can configure in AccessAdmin. Use this guide along with the IBM Security Access Manager for Enterprise Single Sign-On Administrator Guide. v IBM Security Access Manager for Enterprise Single Sign-On Help Desk Guide, SC This guide is intended for Help desk officers. IBM Security Access Manager for Enterprise Single Sign-On Help Desk Guide provides Help desk officers information about managing queries and requests from users usually about their authentication factors. Use this guide together with the IBM Security Access Manager for Enterprise Single Sign-On Policies Definition Guide. v IBM Security Access Manager for Enterprise Single Sign-On User Guide, SC This guide is intended for the users. IBM Security Access Manager for Enterprise Single Sign-On User Guide provides instructions for using AccessAgent and Web Workplace. v IBM Security Access Manager for Enterprise Single Sign-On Troubleshooting and Support Guide, GC IBM Security Access Manager for Enterprise Single Sign-On Troubleshooting and Support Guide provides information about issues with regards to installation, upgrade, and product usage. This guide covers the known issues and limitations of the product. It helps you determine the symptoms and workaround for the problem. It also provides information about fixes, knowledge bases, and support. v IBM Security Access Manager for Enterprise Single Sign-On Error Message Reference Guide, GC IBM Security Access Manager for Enterprise Single Sign-On Error Message Reference Guide describes all the informational, warning, and error messages that are associated with IBM Security Access Manager for Enterprise Single Sign-On. v IBM Security Access Manager for Enterprise Single Sign-On AccessStudio Guide, SC IBM Security Access Manager for Enterprise Single Sign-On AccessStudio Guide provides information about creating and using AccessProfiles. This guide provides procedures for creating and editing standard and advanced AccessProfiles for different application types. It also covers information about managing authentication services and application objects, and information about other functions and features of AccessStudio. v IBM Security Access Manager for Enterprise Single Sign-On AccessProfile Widgets Guide, SC IBM Security Access Manager for Enterprise Single Sign-On AccessProfile Widgets Guide provides information about creating and using widgets. v IBM Security Access Manager for Enterprise Single Sign-On Tivoli Endpoint Manager Integration Guide, SC vi IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

9 IBM Security Access Manager for Enterprise Single Sign-On Tivoli Endpoint Manager Integration Guide provides information about how to create and deploy Fixlets for AccessAgent installation, upgrade or patch management. It also includes topics about using and customizing the dashboard to view information about AccessAgent deployment on the endpoints. v IBM Security Access Manager for Enterprise Single Sign-On Provisioning Integration Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Provisioning Integration Guide provides information about the different Java and SOAP API for provisioning. It also covers procedures for installing and configuring the Provisioning Agent. v IBM Security Access Manager for Enterprise Single Sign-On Web API for Credential Management Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Web API for Credential Management Guide provides information about installing and configuring the Web API for credential management. v IBM Security Access Manager for Enterprise Single Sign-On Serial ID SPI Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Serial ID SPI Guide describes how to integrate any device with serial numbers and use it as a second authentication factor with AccessAgent. v IBM Security Access Manager for Enterprise Single Sign-On Epic Integration Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Epic Integration Guide provides information about the IBM Security Access Manager for Enterprise Single Sign-On and Epic integration, including supported workflows, configurations, and deployment. v IBM Security Access Manager for Enterprise Single Sign-On Context Management Integration Guide, SC IBM Security Access Manager for Enterprise Single Sign-On Context Management Integration Guide provides information about installing, configuring, and testing the Context Management integrated solution in each client workstation. v IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Mobile Guide, SC IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Mobile Guide provides information about the deployment and use of single sign-on on mobile devices. v IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Virtual Desktop Infrastructure Guide, SC IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Virtual Desktop Infrastructure Guide provides information about setting up single sign-on support on a Virtual Desktop Infrastructure, and the different user workflows for accessing the virtual desktop. v IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Terminal Server and Citrix Server Guide, SC IBM Security Access Manager for Enterprise Single Sign-On AccessAgent on Terminal Server and Citrix Server Guide provides information about the required configurations and supported workflows in the Terminal and Citrix Servers. About this publication vii

10 Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security Access Manager for Enterprise Single Sign-On library The product documentation site ( tivihelp/v2r1/index.jsp?topic=/com.ibm.itamesso.doc_8.2.1/kchomepage.html) displays the welcome page and navigation for the library. IBM Security Systems Documentation Central IBM Security Systems Documentation Central provides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific versions of each product. IBM Publications Center IBM Publications Center offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at software/globalization/terminology. Accessibility Technical training Support information Accessibility features help users with a physical disability, such as restricted mobility or limited vision, to use software products successfully. With this product, you can use assistive technologies to hear and navigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see "Accessibility features" in the IBM Security Access Manager for Enterprise Single Sign-On Planning and Deployment Guide. For technical training information, see the following IBM Education website at IBM Support provides assistance with code-related problems and routine, short duration installation or usage questions. You can directly access the IBM Software Support site at IBM Security Access Manager for Enterprise Single Sign-On Troubleshooting and Support Guide provides details about: v What information to collect before contacting IBM Support. v The various methods for contacting IBM Support. v How to use IBM Support Assistant. v Instructions and problem-determination resources to isolate and fix the problem yourself. viii IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

11 Note: The Community and Support tab on the product information center can provide additional support resources. Statement of Good Security Practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. About this publication ix

12 x IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

13 Chapter 1. Overview of the product integration with Epic Epic is a healthcare software company that offers applications that are related to patient care. You can integrate IBM Security Access Manager for Enterprise Single Sign-On with the Epic application through an Epic-defined interface to provide single sign-on support. Design overview When a user starts the Epic application, the application runs a callback function as a dynamic linked library (DLL). A callback function is an executable code that is passed as a variable to another code. A dynamic link library is a file that is shared by executable files and other shared files. The callback function uses an AccessProfile to retrieve credentials from IBM Security Access Manager for Enterprise Single Sign-On. It then passes the credentials to the Epic application. The Epic application authenticates the user and then logs on the user. The callback function and AccessProfile communicate with each other using invisible windows. The AccessProfile controls workflows such as capture, injection, and re-authentication. See the IBM Security Access Manager for Enterprise Single Sign-On AccessStudio Guide for more information about AccessProfiles. See the Epic website for more details about the Epic application. Supported setup The integration with the Epic application is supported for shared desktop and personal desktop, in Windows XP and Windows 7, 34-bit and 64-bit. Copyright IBM Corp. 2002,

14 2 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

15 Chapter 2. Supported workflows and Epic configurations There are several workflows that are involved with IBM Security Access Manager for Enterprise Single Sign-On. Some of these workflows are supported in the integration with the Epic application, but depends on the user repository that is used. See the following tables for a summary of workflows and configurations that are supported based on the type of user repository that Epic uses. Table 1. Supported AccessAgent workflows Workflows Epic uses its own user repository Epic uses Active Directory Password injection Yes Yes No Capture password Yes Yes No Change password Yes Yes No User re-authentication User authorization (authentication of a user who is different from the user that is logged on to AccessAgent) User re-authentication with second factor User authorization with second factor Yes Yes No No Yes No No No No No No No Epic uses a third-party repository The re-authentication workflow is supported whether the Epic application uses its own user repository or an Active Directory. The AccessProfile bundled with the AccessProfile package takes care of the authorization workflow only. However, the AccessProfile can be easily changed in the field to support re-authentication or any customization when the need arises. The authorization workflow is: v Supported if the Epic application is using an Active Directory. When the following credentials are synchronized, the AccessProfile prompts for the Active Directory password of the user. This user is the one whose ID is given to the login device module of the Epic system. ISAM ESSO user name and password Active Directory user name and password Epic user name and password v Not supported if the Epic application is using its own user repository. Authorization involves opening another user Wallet and injecting the Epic password from that Wallet. The Epic user name must be mapped to the ISAM ESSO user name unless these user names are synchronized. Copyright IBM Corp. 2002,

16 Table 2. Supported Epic configurations Epic configurations User clicks Secure desktop Epic application automatically secures desktop because of no activity Epic application automatically logs out the user because of no activity Epic application automatically shuts down itself because of no activity Epic uses its own user repository Epic uses Active Directory No Yes No No Yes No No Yes No No Yes No Epic uses a third-party repository 4 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

17 Chapter 3. Epic support deployment Deploy the InstallEpicAdapter.bat file to all client computers to install single sign-on support for the Epic application. Prerequisite To deploy single sign-on support for the Epic application, ensure that you have: v An IMS Server installed and configured v The Epic support package The package contains the following files: File InstallEpicAdapter.bat EpicAdapter.dll Epic AccessProfile Purpose Registers the EpicAdapter.dll in the Windows registry. Implements the login device interface for IBM Security Access Manager for Enterprise Single Sign-On. Controls the capture, injection, re-authentication, and is used for customization workflows. v AccessAdmin Administrator privilege to upload AccessProfiles in the IMS Server. Note: If you want to use AccessStudio to edit the Epic AccessProfile, ensure that you install AccessAgent before you install AccessStudio. Deploying single sign-on support The deployment procedure varies depending on whether AccessAgent is already installed. If AccessAgent is already installed 1. Download the compressed file from the AccessProfile Library to your computer. The compressed file contains the InstallEpicAdapter.bat, EpicAdapter.dll, and AccessProfile files. 2. Deploy the InstallEpicAdapter.bat to all client computers. You can use software deployment tools like the Active Directory Group Policy Object (AD GPO). Note: You must run the file as an Administrator to complete this task in Windows 7. You must have Administrator privileges to complete this task in Windows XP. 3. Upload the AccessProfile to the IMS Server with AccessStudio. a. Open the AccessProfile in AccessStudio. b. Select the AccessProfile from the Data type pane. c. Click Upload selected data to IMS from the toolbar. If AccessAgent is not yet installed Copyright IBM Corp. 2002,

18 1. Download the compressed file from the AccessProfile Library to your computer. The compressed file contains the InstallEpicAdapter.bat, EpicAdapter.dll, and AccessProfile files. 2. Copy InstallEpicAdapter.bat and EpicAdapter.dll. 3. Select the Config folder of the AccessAgent installation package. For example: C:\Downloads\ISAM ESSO\Config. 4. Paste the InstallEpicAdapter.bat and EpicAdapter.dll files in the Config folder. 5. Modify the DeploymentScript.vbs in the Config folder. a. Open the DeploymentScript.vbs. b. Copy the following functions and paste them at the end of the script. Function RegEpicAdapter Register Epic adapter Dim strcomcmd : strcomcmd = """" & INSTALLDIR & "InstallEpicAdapter.bat"" -nc" shell.run strcomcmd, 0, false End Function Function UnregEpicAdapter Unregister Epic adapter Dim strcomcmd : strcomcmd = """" & INSTALLDIR & "InstallEpicAdapter.bat"" -u" shell.run strcomcmd, 0, false End Function c. Modify the following functions in the script and add the code that is shown in bold. sub PostCopy() (Any existing code) Register Epic adapter RegEpicAdapter end sub sub PreRemove() (Any existing code) Unregister Epic adapter UnregEpicAdapter end sub d. Save the script. 6. Install AccessAgent. Epic server configuration To configure the Epic Server and to implement the Epic login, contact the Epic System Administrator. Important: In the Epic server configuration, the EpicAdapter.dll programmatic ID is EpicImpl.ISAMESSOIEpicDevice. 6 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

19 Chapter 4. Customization The Epic AccessProfile in the package is a template. Modify the AccessProfile if there are changes to the authentication service or signature value of the Epic application. Changing the authentication service in an AccessProfile If you use another authentication service like Active Directory, change the authentication service in the AccessProfile to ensure that the AccessProfile retrieves the correct credentials. About this task Make sure that the authentication service in the AccessProfile matches the authentication service that is used by your organization. Procedure 1. Open the Epic AccessProfile in AccessStudio. The Epic AccessProfile is included in the Epic application support package. See Chapter 3, Epic support deployment, on page 5 for more details. 2. Locate an action that requires an authentication service. For example: Inject credentials. 3. Click the action. 4. In the Form Editor tab, select Auth Info > Direct-Authentication Service > Authentication service id. 5. Enter your authentication service id. 6. Apply steps 3-5 to all actions that require an authentication service. 7. Save the AccessProfile. What to do next Upload the AccessProfile to the IMS Server. Changing the signature in the AccessProfile A signature in an AccessProfile contains a unique identification information for any application, window, or field. Change the signature in the Epic AccessProfile so that the AccessProfile can determine the name of the Epic application where the login workflow can run. Procedure 1. Open the AccessProfile in AccessStudio. 2. Select the AccessProfile. 3. In the General Properties tab, select Signatures identifying web-page or exe where this is AccessProfile is to be loaded. 4. Click Edit. 5. Drag the Finder tool and drop it on the Epic application window. 6. Click OK. Copyright IBM Corp. 2002,

20 Note: You must add one signature for each Epic application that needs single sign-on. See Capturing a signature for more information. 8 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

21 Chapter 5. Audit logs for Epic You can create audit logs using an AccessProfile so that you can view the details of each workflow. You can modify the Epic AccessProfile and add your custom audit log actions. See "Generating custom audit logs" in the IBM Security Access Manager for Enterprise Single Sign-On AccessStudio Guide for more information. You can collect and view the audit logs in AccessAdmin. See "Collecting audit logs in AccessAdmin" in the IBM Security Access Manager for Enterprise Single Sign-On Administrator Guide for more information. Copyright IBM Corp. 2002,

22 10 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

23 Chapter 6. Troubleshooting checklist for Epic Answer the questions so that you can identify the source of a problem that is occurring with the Epic application. Is the Programmatic ID correct? Make sure that the Programmatic ID is EpicImpl.ISAMESSOIEpicDevice in the server configuration. For more information, see the Epic Administrator. Is the Epic AccessProfile uploaded in the IMS Server? You can verify by completing the following steps: 1. Open AccessStudio. 2. Select File > Import data from IMS. The AccessProfile is displayed if it is uploaded in the IMS Server. Otherwise, download the AccessProfile again. See Chapter 3, Epic support deployment, on page 5 for more details. Is the EpicAdapter.dll registered in the Windows Registry? You can verify by completing the following steps: 1. On your Windows desktop, select Start > Run. 2. Type regedit in the Open field. 3. Click OK. 4. Select Edit > Find. 5. Type EpicAdapter.dll in the Find what field. 6. Click Find Next. The EpicAdapter.dll is at My Computer > HKEY_LOCAL_MACHINE > SOFTWARE > Classes > AppID > EpicAdapter.DLL in the Windows Registry. Does the EpicAdapter.dll work properly? You can verify by displaying the invisible windows. 1. On your Windows desktop, select Start > Control Panel > System > Advanced > Environment Variables. 2. Under System variables, click New. 3. In the Variable name field, type ISAMESSO_EPIC_WINDOW. 4. In the Variable value field, type SHOW. 5. Click OK. 6. Test the EpicAdapter.dll with the Epic login device host. For more information, see the Epic Administrator. After verifying, you must delete the ISAMESSO_EPIC_WINDOW variable. 1. On your Windows desktop, select Start > Control Panel > System > Advanced > Environment Variables. 2. Under System variables, select ISAMESSO_EPIC_WINDOW. 3. Click Delete. 4. Click OK. What logs were issued? Copyright IBM Corp. 2002,

24 You can verify by checking the Observer logs. 1. Open the IBM Security Access Manager for Enterprise Single Sign-On folder location. For example: C:\Program Files\IBM\ISAMESSO\AA\Logs\. 2. Open aa_observer.log to verify the result of an activity: v The user is logged in successfully. v The EpicAdapter.dll loaded correctly. v The invisible windows opened successfully. 12 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

25 Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan, Ltd , Nihonbashi-Hakozakicho, Chuo-ku Tokyo , Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law : INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. Copyright IBM Corp. 2002,

26 IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary. This information is for planning purposes only. The information herein is subject to change before the products described become available. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to 14 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

27 IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM's application programming interfaces. If you are viewing this information in softcopy form, the photographs and color illustrations might not be displayed. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information; at Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. UNIX is a registered trademark of The Open Group in the United States and other countries. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Notices 15

28 Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Other company, product, and service names may be trademarks or service marks of others. Privacy Policy Considerations IBM Software products, including software as a service solutions, ( Software Offerings ) may use cookies or other technologies to collect product usage information, to help improve the end user experience, to tailor interactions with the end user or for other purposes. In many cases no personally identifiable information is collected by the Software Offerings. Some of our Software Offerings can help enable you to collect personally identifiable information. If this Software Offering uses cookies to collect personally identifiable information, specific information about this offering s use of cookies is set forth below. This Software Offering uses other technologies that collect each user's user name, password or other personally identifiable information for purposes of session management, authentication, single sign-on configuration or other usage tracking or functional purposes. These technologies can be disabled, but disabling them will also eliminate the functionality they enable. If the configurations deployed for this Software Offering provide you as customer the ability to collect personally identifiable information from end users via cookies and other technologies, you should seek your own legal advice about any laws applicable to such data collection, including any requirements for notice and consent. For more information about the use of various technologies, including cookies, for these purposes, see IBM s Privacy Policy at and IBM s Online Privacy Statement at sections entitled Cookies, Web Beacons and Other Technologies and Software Products and Software-as-a Service. 16 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

29 Glossary This glossary includes terms and definitions for IBM Security Access Manager for Enterprise Single Sign-On. The following cross-references are used in this glossary: v See refers you from a term to a preferred synonym, or from an acronym or abbreviation to the defined full form. v See also refers you to a related or contrasting term. To view glossaries for other IBM products, go to terminology (opens in new window). A account data The logon information required to verify an authentication service. It can be the user name, password, and the authentication service which the logon information is stored. account data bag A data structure that holds user credentials in memory while single sign-on is performed on an application. account data item The user credentials required for logon. account data item template A template that defines the properties of an account data item. account data template A template that defines the format of account data to be stored for credentials captured using a specific AccessProfile. action In profiling, an act that can be performed in response to a trigger. For example, automatic filling of user name and password details as soon as a sign-on window displays. Active Directory (AD) A hierarchical directory service that enables centralized, secure management of an entire network, which is a central component of the Microsoft Windows platform. Active Directory credential The Active Directory user name and password. Active Directory password synchronization An IBM Security Access Manager for Enterprise Single Sign-On feature that synchronizes the ISAM ESSO password with the Active Directory password. active radio frequency identification (active RFID) A second authentication factor and presence detector. See also radio frequency identification. active RFID See active radio frequency identification. AD See Active Directory. administrator A person responsible for administrative tasks such as access authorization and content management. Administrators can also grant levels of authority to users. API See application programming interface. application A system that provides the user interface for reading or entering the authentication credentials. application policy A collection of policies and attributes governing access to applications. application programming interface (API) An interface that allows an application program that is written in a high-level language to use specific data or functions of the operating system or another program. audit A process that logs the user, Administrator, and Helpdesk activities. authentication factor The device, biometrics, or secrets required as a credentials for validating digital identities. Examples of authentication Copyright IBM Corp. 2002,

30 factors are passwords, smart card, RFID, biometrics, and one-time password tokens. authentication service A service that verifies the validity of an account; applications authenticate against their own user store or against a corporate directory. authorization code An alphanumeric code generated for administrative functions, such as password resets or two-factor authentication bypass. auto-capture A process that allows a system to collect and reuse user credentials for different applications. These credentials are captured when the user enters information for the first time, and then stored and secured for future use. automatic sign-on A feature where users can log on to the sign-on automation system and the system logs on the user to all other applications. B base distinguished name A name that indicates the starting point for searches in the directory server. base image A template for a virtual desktop. bidirectional language A language that uses a script, such as Arabic and Hebrew, whose general flow of text proceeds horizontally from right to left, but numbers, English, and other left-to-right language text are written from left to right. bind distinguished name A name that specifies the credentials for the application server to use when connecting to a directory service. The distinguished name uniquely identifies an entry in a directory. biometrics The identification of a user based on a physical characteristic of the user, such as a fingerprint, iris, face, voice, or handwriting. C CA CAPI See certificate authority. See cryptographic application programming interface. Card Serial Number (CSN) A unique data item that identifies a hybrid smart card. It has no relation to the certificates installed in the smart card CCOW See Clinical Context Object Workgroup. cell A group of managed processes that are federated to the same deployment manager and can include high-availability core groups. certificate In computer security, a digital document that binds a public key to the identity of the certificate owner, thereby enabling the certificate owner to be authenticated. A certificate is issued by a certificate authority and is digitally signed by that authority. See also certificate authority. certificate authority (CA) A trusted third-party organization or company that issues the digital certificates. The certificate authority typically verifies the identity of the individuals who are granted the unique certificate. See also certificate. CLI See command-line interface. Clinical Context Object Workgroup (CCOW) A vendor independent standard, for the interchange of information between clinical applications in the healthcare industry. cluster A group of application servers that collaborate for the purposes of workload balancing and failover. command-line interface (CLI) A computer interface in which the input and output are text based. credential Information acquired during authentication that describes a user, group associations, or other security-related identity attributes, and that is used to perform services such as authorization, auditing, or delegation. For example, a 18 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

31 user ID and password are credentials that allow access to network and system resources. cryptographic application programming interface (CAPI) An application programming interface that provides services to enable developers to secure applications using cryptography. It is a set of dynamically-linked libraries that provides an abstraction layer which isolates programmers from the code used to encrypt the data. cryptographic service provider (CSP) A feature of the i5/os operating system that provides APIs. The CCA Cryptographic Service Provider enables a user to run functions on the 4758 Coprocessor. CSN CSP D See Card Serial Number. See cryptographic service provider. dashboard An interface that integrates data from a variety of sources and provides a unified display of relevant and in-context information. database server A software program that uses a database manager to provide database services to other software programs or computers. data source The means by which an application accesses data from a database. deployment manager A server that manages and configures operations for a logical group or cell of other servers. deployment manager profile A WebSphere Application Server runtime environment that manages operations for a logical group, or cell, of other servers. deprovision To remove a service or component. For example, to deprovision an account means to delete an account from a resource. See also provision. desktop pool A collection of virtual desktops of similar configuration intended to be used by a designated group of users. directory A file that contains the names and controlling information for objects or other directories. directory service A directory of names, profile information, and machine addresses of every user and resource on the network. It manages user accounts and network permissions. When a user name is sent, it returns the attributes of that individual, which might include a telephone number, as well as an address. Directory services use highly specialized databases that are typically hierarchical in design and provide fast lookups. disaster recovery The process of restoring a database, system, policies after a partial or complete site failure that was caused by a catastrophic event such as an earthquake or fire. Typically, disaster recovery requires a full backup at another location. disaster recovery site A secondary location for the production environment in case of a disaster. distinguished name (DN) The name that uniquely identifies an entry in a directory. A distinguished name is made up of attribute:value pairs, separated by commas. For example, CN=person name and C=country or region. DLL DN DNS See dynamic link library. See distinguished name. See domain name server. domain name server (DNS) A server program that supplies name-to-address conversion by mapping domain names to IP addresses. dynamic link library (DLL) A file containing executable code and data bound to a program at load time or run time, rather than during linking. The code and data in a DLL can be shared by several applications simultaneously. Glossary 19

32 E enterprise directory A directory of user accounts that define IBM Security Access Manager for Enterprise Single Sign-On users. It validates user credentials during sign-up and logon, if the password is synchronized with the enterprise directory password. An example of an enterprise directory is Active Directory. enterprise single sign-on (ESSO) A mechanism that allows users to log on to all applications deployed in the enterprise by entering a user ID and other credentials, such as a password. ESSO See enterprise single sign-on. event code A code that represents a specific event that is tracked and logged into the audit log tables. F failover An automatic operation that switches to a redundant or standby system or node in the event of a software, hardware, or network interruption. fast user switching A feature that allows users to switch between user accounts on a single workstation without quitting and logging out of applications. Federal Information Processing Standard (FIPS) A standard produced by the National Institute of Standards and Technology when national and international standards are nonexistent or inadequate to satisfy the U.S. government requirements. FIPS See Federal Information Processing Standard. fix pack A cumulative collection of fixes that is released between scheduled refresh packs, manufacturing refreshes, or releases. A fix pack updates the system to a specific maintenance level. FQDN See fully qualified domain name. fully qualified domain name (FQDN) In Internet communications, the name of a host system that includes all of the subnames of the domain name. An example of a fully qualified domain name is rchland.vnet.ibm.com. See also host name. G GINA GPO See graphical identification and authentication. See group policy object. graphical identification and authentication (GINA) A dynamic link library that provides a user interface that is tightly integrated with authentication factors and provides password resets and second factor bypass options. group policy object (GPO) A collection of group policy settings. Group policy objects are the documents created by the group policy snap-in. Group policy objects are stored at the domain level, and they affect users and computers contained in sites, domains, and organizational units. H HA See high availability. high availability (HA) The ability of IT services to withstand all outages and continue providing processing capability according to some predefined service level. Covered outages include both planned events, such as maintenance and backups, and unplanned events, such as software failures, hardware failures, power failures, and disasters. host name In Internet communication, the name given to a computer. The host name might be a fully qualified domain name such as mycomputer.city.company.com, or it might be a specific subname such as mycomputer. See also fully qualified domain name, IP address. hot key A key sequence used to shift operations 20 IBM Security Access Manager for Enterprise Single Sign-On: Epic Integration Guide

33 between different applications or between different functions of an application. hybrid smart card An ISO-7816 compliant smart card which contains a public key cryptography chip and an RFID chip. The cryptographic chip is accessible through contact interface. The RFID chip is accessible through contactless (RF) interface. I interactive graphical mode A series of panels that prompts for information to complete the installation. IP address A unique address for a device or logical unit on a network that uses the Internet Protocol standard. See also host name. J Java Management Extensions (JMX) A means of doing management of and through Java technology. JMX is a universal, open extension of the Java programming language for management that can be deployed across all industries, wherever management is needed. Java runtime environment (JRE) A subset of a Java developer kit that contains the core executable programs and files that constitute the standard Java platform. The JRE includes the Java virtual machine (JVM), core classes, and supporting files. Java virtual machine (JVM) A software implementation of a processor that runs compiled Java code (applets and applications). JMX JRE JVM K See Java Management Extensions. See Java runtime environment. See Java virtual machine. keystore In security, a file or a hardware cryptographic card where identities and private keys are stored, for authentication L LDAP and encryption purposes. Some keystores also contain trusted or public keys. See also truststore. See Lightweight Directory Access Protocol. Lightweight Directory Access Protocol (LDAP) An open protocol that uses TCP/IP to provide access to directories that support an X.500 model. An LDAP can be used to locate people, organizations, and other resources in an Internet or intranet directory. lightweight mode A Server AccessAgent mode. Running in lightweight mode reduces the memory footprint of AccessAgent on a Terminal or Citrix Server and improves the single sign-on startup duration. linked clone A copy of a virtual machine that shares virtual disks with the parent virtual machine in an ongoing manner. load balancing The monitoring of application servers and management of the workload on servers. If one server exceeds its workload, requests are forwarded to another server with more capacity. lookup user A user who is authenticated in the Enterprise Directory and searches for other users. IBM Security Access Manager for Enterprise Single Sign-On uses the lookup user to retrieve user attributes from the Active Directory or LDAP enterprise repository. M managed node A node that is federated to a deployment manager and contains a node agent and can contain managed servers. See also node. mobile authentication An authentication factor which allows mobile users to sign-on securely to corporate resources from anywhere on the network. Glossary 21